# ForgeFlow roadmap

## Delivered in v0.8

- partial-hunk staging with staged-only commits;
- guided conflict resolution and safe continue/abort controls;
- Gitea branch-protection awareness and pull-request creation;
- configurable editor/terminal integration;
- deployment freezes, maintenance windows, release notes and overrides;
- append-only audit export and encrypted credential-free configuration backup;
- native notifications, tray, close-to-tray and start-at-login;
- guarded real-environment deploy/rollback acceptance harness.

## Delivered through v0.4

- coherent Local -> Gitea -> Server desktop model;
- protected Gitea credential storage and strict IPC boundary;
- real Git status, diff, stage, commit, push, fetch and fast-forward pull;
- branches, stashes, favorites and automatic local awareness;
- multiple Gitea Actions and SSH / Unraid deployment profiles;
- exact-SHA remote-branch validation, runner polling, request-ID verification, health and rollback;
- five-step readiness/setup wizard;
- system and deployment preflight engine;
- structured rotating diagnostic JSONL logs;
- aggressive credential/path redaction;
- standard/strict support bundles with SHA-256 and fail-closed safety audit;
- no automatic ingestion or persistence of raw runner logs;
- root-owned declarative server target configuration;
- cross-layer request-ID correlation;
- canonical end-to-end setup guide;
- 36 automated tests.

The source is now intended to be locally configured and testable without
sharing credentials. It remains a developer preview until a real environment
acceptance pass is completed.

## Milestone A — Real personal acceptance

- run the canonical setup guide on the target Windows machine;
- connect the actual Gitea instance locally;
- use one non-critical staging repository;
- register a narrowly scoped trusted runner;
- install the target configuration, entry point and status endpoint;
- pass Deployment preflight;
- validate commit -> push -> deploy -> status -> health -> rollback;
- deliberately test stopped runner, wrong branch, missing workflow, failed
  health and lock contention;
- export/inspect a strict diagnostic bundle from a failed test;
- capture only non-secret environment-specific adjustments in documentation.

Exit: one real application can be released and restored without code changes to
ForgeFlow itself.

## Milestone B — Git completeness

- partial-hunk staging/discard;
- amend and signing checks;
- richer branch publication/upstream controls;
- conflict helper and editor integration;
- protected-branch awareness;
- pull-request creation;
- submodule/worktree policy.

## Milestone C — Desktop operations

- native notifications and system tray;
- background start preference;
- notification center;
- native menus and expanded keyboard navigation;
- configurable editor/terminal commands;
- repository attention rules and snoozing;
- safer periodic remote fetch scheduling.

## Milestone D — Recovery and audit

- append-only audit export distinct from diagnostics;
- deployment notes and release annotations;
- explicit reconciliation of externally deployed versions;
- per-environment recovery runbook links;
- encrypted configuration backup/restore without token export;
- deployment freeze and maintenance-window policies.

## Milestone E — Additional controlled adapters

- mutually authenticated ForgeFlow server agent;
- Portainer stack deployment;
- systemd adapter;
- Kubernetes adapter.

Every adapter must retain exact version identity, allowlisting, lock control,
health verification, diagnostic correlation and no arbitrary shell input.

## Milestone F — Productization

- Windows installer/portable acceptance;
- macOS/Linux package validation;
- code signing, notarization and signed updates;
- dependency/secret/package scans;
- accessibility review;
- hundreds-of-repositories performance tests;
- opt-in privacy-aware crash reporting;
- documented Gitea/Git/runner support matrix;
- stable configuration migration rollback policy.

- built-in private-Gitea source updater with backup and rollback;
- Unraid server inventory, generated basic Compose and exact-SHA SSH deployment.